1#!/bin/sh 2 3# 4# SPDX-License-Identifier: BSD-2-Clause-FreeBSD 5# 6# Copyright (c) 2022 Peter Holm <pho@FreeBSD.org> 7# 8# Redistribution and use in source and binary forms, with or without 9# modification, are permitted provided that the following conditions 10# are met: 11# 1. Redistributions of source code must retain the above copyright 12# notice, this list of conditions and the following disclaimer. 13# 2. Redistributions in binary form must reproduce the above copyright 14# notice, this list of conditions and the following disclaimer in the 15# documentation and/or other materials provided with the distribution. 16# 17# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27# SUCH DAMAGE. 28# 29 30# A sigreturn(2) syscall fuzzer 31 32# panic: vm_fault_lookup: fault on nofault entry, addr: 0 33# cpuid = 0 34# time = 1661248103 35# KDB: stack backtrace: 36# db_trace_self_wrapper(e,27e1dae0,27e1dae2,ffc07db8,c1f0490,...) at db_trace_self_wrapper+0x28/frame 0xffc07d24 37# vpanic(150b260,ffc07d60,ffc07d60,ffc07e20,12cb565,...) at vpanic+0xf4/frame 0xffc07d40 38# panic(150b260,14ec2f3,0,149349d,1430,...) at panic+0x14/frame 0xffc07d54 39# vm_fault(1e37000,0,4,0,0) at vm_fault+0x1725/frame 0xffc07e20 40# vm_fault_trap(1e37000,3b,4,0,0,0) at vm_fault_trap+0x52/frame 0xffc07e48 41# trap_pfault(3b,0,0) at trap_pfault+0x176/frame 0xffc07e94 42# trap(ffc07f6c,8,28,28,1915b000,...) at trap+0x2d9/frame 0xffc07f60 43# calltrap() at 0xffc031ef/frame 0xffc07f60 44# --- trap 0xc, eip = 0x3b, esp = 0xffc07fac, ebp = 0xffc0340c --- 45# (null)() at 0x3b/frame 0xffc0340c 46# KDB: enter: panic 47# [ thread pid 26126 tid 120029 ] 48# Stopped at kdb_enter+0x34: movl $0,kdb_why 49# db> x/s version 50# version: FreeBSD 14.0-CURRENT #0 ast-n257558-eb20af97a66-dirty: Mon Aug 22 17:53:22 CEST 2022 51# pho@mercat1.netperf.freebsd.org:/media/obj/var/tmp/deviant3/i386.i386/sys/PHO 52# db> 53 54inc=/usr/include/sys/syscall.h 55[ -f $inc ] || exit 0 56num=`awk '/SYS_sigreturn/ {print $NF}' < $inc` 57old=`grep -E 'sigreturn \*' < $inc | \ 58 sed 's/.* \([0-9]\{1,3\}\) .*/\1/' | tr '\n' ' '` 59num="$num $old" 60 61start=`date +%s` 62while [ $((`date +%s` - start)) -lt 180 ]; do 63 for i in $num; do 64 echo "noswap=1 ./syscall4.sh $i" 65 noswap=1 ./syscall4.sh $i 66 done 67done 68 69exit 0 70